MalwareTipsTools

File scan report

Scan another file

Verdict Suspicious

Analyzed , 2 days ago

Is suf_launch.exe safe? Treat it as suspicious.

Conflicting sandbox results and three malware-specific community rules outweigh the valid signature and lone potentially unwanted program detection, warranting caution.

Why Suspicious? One antivirus engine (Malwarebytes) flags it and a community rule for known malware matched it.

Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.

Don't run it until you know where it came from

If it came from a link, an attachment or a stranger, delete it.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

  1. Don't run it unless you're sure where it came from.

  2. Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.

  3. If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already ran it

  1. Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

suf_launch.exe: Suspicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

1 of 65 flagged

  • Flagged 1
  • No detection 64
  • No result 10
Filesuf_launch.exe62.0 MBSHA-256 198cb8b4ac93…aa1751
  • Code signing TLauncher Inc.
  • Test run Completed
  • First seen 2mo ago
A sandbox test run rated its behaviour as malicious.

Chapter 02

Why we think so

4 points against it and 5 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

Malwarebytes alone labeled the executable as potentially unwanted, while the major engines did not flag it. However, one sandbox result was malicious, another was clean, and three malware-specific community rules matched, so the file should not be trusted without further verification.

Full reasoning

Only 1 of the 65 antivirus engines that checked it flagged the executable, using a potentially unwanted program label, and no major engine detected it. The executable has a valid TLauncher Inc. signature, but the available publisher history is too small to establish a reliable benign pattern. Runtime results conflict: a sandbox result reported malware while another reported clean, with no named injection target or other high-risk runtime technique recorded. Three malware-specific community rules add concern, although their names do not agree on a credible family and are not enough to establish ransomware or a backdoor. The complete host-reputation check found no flagged contacts, leaving materially mixed evidence rather than a conclusive malware identification.

Detailed assessment

What We Detected

Malwarebytes was the only engine among 75 to flag the executable, labeling it as a potentially unwanted TLauncher component. No major engine detected it, and the file carries a valid TLauncher Inc. signature. Publisher history is limited to two samples, so the signature does not by itself resolve the conflicting evidence.

Threat Behavior

The evidence from the test run is divided: one sandbox result reported malware and another reported clean. No named process-injection target or other high-risk runtime technique was recorded. Three malware-specific community rules matched patterns associated with ransomware, an altered DOS stub, and a bot framework, but those disparate labels do not establish one credible family. The observed host contacts received no malicious or suspicious reputation hits, and no inspected child was identified as harmful.

What To Do Now

Do not run the executable on an important system unless its source and expected publisher can be independently verified. Keep security software enabled, and obtain a fresh copy through the publisher channel you intended to use if there is any uncertainty.

Where this verdict could be wrong5 caveats
  • Only Malwarebytes flagged the file, and its PUP.Optional.TLauncher label describes a potentially unwanted program rather than a specific malware family.
  • The TLauncher Inc. signature verified successfully, although the available publisher history contains only two samples.
  • The complete reputation check for four observed domain and IP contacts found no known malicious or suspicious hosts.
  • No named injection target, high-risk runtime technique, malicious child, packing, or high-entropy code was identified.
  • The file has been submitted by 3,700 sources, and one prior file with the same signer received a clean verdict.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • The executable's TLauncher Inc. signature passed verification.
  • No major antivirus engine flagged the file.
  • The complete check of four observed domain and IP contacts found no known malicious or suspicious hosts.
  • No packing or unusually high-entropy code was identified.
  • No named process-injection target or harmful inspected child was found.
Points against
  • A sandbox result reported malware, although another result was clean.
  • Three malware-specific community rules matched unrelated high-risk patterns.
  • Malwarebytes labeled the executable as a potentially unwanted TLauncher component.
  • The file's reputation score is negative despite broad submission history.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 6 isolated tests; 1 test environment rated what it did as risky.

Test run summary

Capture complete
  • 6isolated sandbox runs
  • 13sandbox rule tags
  • 3spawned processes
  • 4network contacts
  • 32filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).

  • Moderate concern: Ran commands or a script on the test computer.

  • Moderate concern: Unpacked hidden content while it ran.

  • Note: Talked to servers over the internet during the test run.

  • Note: Looked through folders on the test computer (most installers do this).

  • Note: Loaded extra code modules while running.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 7: FileSeen in the test run

      suf_launch.exe

      198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 7: ProcessSeen in the test run

      irsetup.exe

      C:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe __IRAOFF:3938314 __IRAFN:C:\Users\<USER>\Downloads\TLauncher-Installer-1.9.7.6.exe __IRCT:3 __IRTSS:61981678 __IRSID:S-1-5-21-4270068108-2931534202-3907561125-1001

      Test run
    2. Evidence 3 of 7: ProcessSeen in the test run

      TLauncher-Installer-1.9.7.6.exe

      "C:\Users\user\Desktop\TLauncher-Installer-1.9.7.6.exe"

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 7: Written fileSeen in the test run

      irsetup.exe

      C:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Test run
    2. Evidence 5 of 7: Written fileSeen in the test run

      lua5.3.dll

      C:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll

      Test run
    3. +1 more recorded observation

  4. Network

    Hosts contacted

    2
    1. Evidence 6 of 7: Contacted hostSeen in the test run

      dl2.tlauncher.org

      Contacted during the test run.

      Test run
    2. Evidence 7 of 7: Contacted hostSeen in the test run

      repository.certum.pl

      Contacted during the test run.

      Test run
    3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 6 sandboxes and the results were split: 1 returned "malicious" and 1 returned "clean".

1 malicious run

Sandbox verdicts

2
  • VT: MALWAREmalicious
  • VT: CLEANclean

Techniques observed in the sandbox

13

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1027· Obfuscated code
  • T1027.002· Obfuscated code
  • T1027.009· Obfuscated code
  • T1059· Runs commands
  • T1063
  • T1071· Application protocol
  • T1083· Scans your files
  • T1112
  • T1116
  • T1129· Loads modules
  • T1140· Deobfuscation
  • T1185
  • T1198

Observed activity

Processes started
3

Programs the file ran, with their command lines.

  • irsetup.exeC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe __IRAOFF:3938314 __IRAFN:C:\Users\<USER>\Downloads\TLauncher-Installer-1.9.7.6.exe __IRCT:3 __IRTSS:61981678 __IRSID:S-1-5-21-4270068108-2931534202-3907561125-1001
  • TLauncher-Installer-1.9.7.6.exe"C:\Users\user\Desktop\TLauncher-Installer-1.9.7.6.exe"
  • irsetup.exe"C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3938314 "__IRAFN:C:\Users\user\Desktop\TLauncher-Installer-1.9.7.6.exe" "__IRCT:3" "__IRTSS:61981678" "__IRSID:S-1-5-21-1070296143-2877979003-364783958-1001"
Network contacts
4

4 hosts, listed as 2 domains, 2 addresses, 4 links. Links show the host and path only.

  • Domaindl2.tlauncher.org
  • Domainrepository.certum.pl
  • IP address104.20.7.182
  • IP address23.200.156.80
  • URLhttp://dl2.tlauncher.org
  • URLhttps://dl2.tlauncher.org/check_latest_tl.php
Show all 8 entries for network contacts
  • URLhttp://repository.certum.pl/ctnca.cer
  • URLhttp://dl2.tlauncher.org:443
Files
28

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Show all 28 entries for files
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG6.PNG
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.BMP
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.BMP
  • WrittenC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\IRIMG6.BMP
  • DeletedC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  • DeletedC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat
  • DeletedC:\Users\<USER>\AppData\Local\Temp\IRWC10F.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\IRWCC6A.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
  • DeletedC:\Users\<USER>\AppData\Local\Temp\check_latest_tl.txt
  • DeletedC:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  • DeletedC:\Users\user\AppData\Local\Temp\_ir_sf_temp_0
  • DeletedC:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat
  • DeletedC:\Users\user\AppData\Local\Temp\IRW8AB1.tmp
  • DeletedC:\Users\user\AppData\Local\Temp\IRWA2A5.tmp
  • DeletedC:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
  • DeletedC:\Users\user\AppData\Local\Temp\check_latest_tl.txt
Registry and auto-start
15

Settings the file changed, including ways to start again after a restart.

  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\DXFeatureLevel
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Revision
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId
Show all 15 entries for registry and auto-start
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\VendorId
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\VersionHigh
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\VersionLow
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-DXFeatureLevel
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-DeviceId
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-Revision
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-SubSysId
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-VendorId
  • SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh
Mutexes
4

Named locks a program uses so only one copy runs; malware families often reuse them.

  • Local\ZonesCacheCounterMutex
  • Local\ZonesLockedCacheCounterMutex
  • Local\MSCTF.Asm.MutexDefault1
  • !IECompat!Mutex
Sandbox background — not the file
2

The analysis machine's own processes and connections, recorded in every run.

  • VM host8.8.8.8
  • VM host162.159.36.2
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked
  • 81b2e287246cfa5dea40…b4be2eNot checked
    no saved verdict
  • 22eb6f08accb3c20caa7…361677Not checked
    no saved verdict
  • 9df00cd36e313b892c9a…db06aaNot checked
    no saved verdict
  • 1d7a67b1c0d620506ac7…aa7ee0Not checked
    no saved verdict
  • 9c893fe1ab940ee4c242…d881e3Not checked
    no saved verdict
  • 4c85cdddd497ad81fedb…c74e26Not checked
    no saved verdict
  • 4d82d90aa27c7f906f60…6362dfNot checked
    no saved verdict
  • 517a9d9a64b6cdb81367…d6702aNot checked
    no saved verdict
  • 3642e6bc8cfac59803bb…513e36Not checked
    no saved verdict
  • ec86b96018d9ef2656af…952d36Not checked
    no saved verdict

Chapter 04

Technical details

1 of the 65 antivirus engines that checked it flags it; signed by TLauncher Inc..

Sources checked

Every check behind this verdict

6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteWorth noting: 1 of 65 engines flagged it · 10 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · C2AE, CAPE Sandbox, VirusTotal JujuboxCompleteWorth noting: 6 runs: 1 malicious, 1 clean, 4 without a verdict Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete4 contacted hosts checked Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesCompleteRisk signal: 14 community YARA rules (3 malware-specific) Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 1

  • MalwarebytesPUP.Optional.TLauncher

File fingerprint

Last analyzed
Nov 8, 2026, 4:16 PM UTC
SHA-256
198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751
SHA-1
80568509f975b6e4c3b1ace0a81fc29349837d00
MD5
3f8ee8ffac2dd0b0118f1d1854551d65

About this file

suf_launch.exe says it is TL Setup (TL), 62.0 MB.

Claims to be
TL Setup (TL)From the file's own version information, written by whoever built it.
Original name
suf_launch.exeMatches the shared file name.
Type and size
Win32 EXE · 62.0 MB
Signer
TLauncher Inc.Valid code signature.
First seen
Aug 13, 2026On VirusTotal.
Submitted by
3,700 distinct sources
Packer
None detected
Entropy
6.03 of 8

First scanned

Antivirus consensus

1 of 65 engines flagged this file

1 malicious0 suspicious64 not flagged10 no result

10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-116 engines
    0flagged
  • Tier-232 engines
    1flagged
  • Low-trust17 engines
    0flagged
View all 75 engine results
  • MalwarebytesMalicious: PUP.Optional.TLauncher
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • APEXClean
  • ArcabitClean
  • AvastNo result
  • Avast-MobileNo result
  • AVGNo result
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetClean
  • DeepInstinctClean
  • DrWebClean
  • ElasticNo result
  • EmsisoftClean
  • ESET-NOD32Clean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleNo result
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicNo result
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneClean
  • SkyhighClean
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrapmineClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

14 YARA
Community YARA rules
Researcher-authored signatures reported by YARAify
  • RANSOMWARE
  • SUSP_XORed_MSDOS_Stub_Message
  • telebot_framework
  • Capability_Embedded_Luageneric
  • certum_issuergeneric
  • CP_Script_Inject_Detectorgeneric
  • DebuggerCheck__APIgeneric
  • detect_certum_issuergeneric
  • DetectEncryptedVariantsgeneric
  • golang_bin_JCorn_CSC846generic
  • PE_Digital_Certificategeneric
  • TH_AntiVM_MassHunt_Win_Malware_2026_CYFAREgeneric
  • UPXgeneric
  • UPXV200V290MarkusOberhumerLaszloMolnarJohnReisergeneric
PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.03Unpacked
Section entropy5 sections
.text
6.52
.rdata
4.99
.data
4.70
.rsrc
5.52
.reloc
4.90
0.0Packed threshold 7.28.0
Prevalence

How widely this file has been seen

Widely uploaded, but first seen within the last six months. No strong prior applies.

Common
Unique uploaders
3,700
Hundreds of people have uploaded this — common.
Total submissions
14,918
Includes repeat uploads by the same source.
First seen
3mo ago
Aug 13, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is suf_launch.exe safe, or is it malware?
suf_launch.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 1 of the 65 antivirus engines that checked it flags it. Don't run it unless you're sure where it came from. If you need the program, download it again from the publisher's own website.
What is suf_launch.exe?
suf_launch.exe is a Windows program, about 62.0 MB. Its version information says it is “TL Setup” (TL). The digital signature from TLauncher Inc. checks out. VirusTotal first saw it on Aug 13, 2026.
How many antivirus engines detected suf_launch.exe?
1 of the 65 antivirus engines that checked it flags suf_launch.exe (Malwarebytes). We weigh which engines flagged it and what else the scan found, not just the count.
What should I do if I already ran suf_launch.exe?
No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.
Is suf_launch.exe digitally signed?
Yes. suf_launch.exe has a valid digital signature from TLauncher Inc., which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.
What is the SHA-256 hash of suf_launch.exe?
The SHA-256 fingerprint of suf_launch.exe is 198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751, and its MD5 is 3f8ee8ffac2dd0b0118f1d1854551d65. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of suf_launch.exe?
This report reflects the scan on Nov 8, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Other files people checked with the same name or signer, and recent reports with the same rating. A matching name does not make two files the same: only the SHA-256 fingerprint identifies a file.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.